@webpieces/http-client-node 0.4.699 → 0.4.701

package/src/ContextBaseUrlFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContextBaseUrlFilter.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ContextBaseUrlFilter.ts"],"names":[],"mappings":";;;AAAA,oDAA6E;AAC7E,0DAAyD;AAEzD,6EAA0E;AAC1E,6CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAa,oBAAqB,SAAQ,kBAA+B;IASxD;IARb;IACI;;;;;;OAMG;IACM,aAAyB,IAAI,uBAAU,EAAE;QAElD,KAAK,EAAE,CAAC;QAFC,eAAU,GAAV,UAAU,CAA+B;IAGtD,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,UAA4C;QACtF,MAAM,QAAQ,GAAG,6BAAc,CAAC,YAAY,CAAC,gCAAoB,CAAC,iBAAiB,CAAC,CAAC;QACrF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,uDAA0B,CAChC,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,0CAA0C;gBACzF,oDAAoD;gBACpD,wFAAwF;gBACxF,aAAa;gBACb,yFAAyF;gBACzF,+EAA+E;gBAC/E,0FAA0F,EAC9F,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CACxD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;CACJ;AA/BD,oDA+BC","sourcesContent":["import { Filter, Service, WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { ClientRequest } from '@webpieces/http-client-core';\nimport { MissingRuntimeBaseUrlError } from './MissingRuntimeBaseUrlError';\nimport { SsrfPolicy } from './SsrfPolicy';\n\n/**\n * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points\n * THIS ONE CALL at it. Ships in the box, and is the whole of the runtime-base-URL feature:\n *\n * ```ts\n * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [\n *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n * ]);\n *\n * for (const webhook of webhooks) {\n *     await RequestContext.run(() => {\n *         RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\n *         return partner.deliver(envelope);\n *     });\n * }\n * ```\n *\n * ## INSTALLING IT IS THE OPT-IN\n *\n * There is no client-level setting saying \"this one may be re-pointed\", because installing this\n * filter IS that statement, written at the one place a reader looks. A client with no\n * `ContextBaseUrlFilter` ignores an ambient `OVERRIDE_BASE_URL` entirely — which is what stops a\n * value set for a partner delivery from silently re-pointing every other client in the same\n * request at the partner's server. `grep -rn ContextBaseUrlFilter` enumerates every client in a\n * codebase that can be re-pointed at all, which is the question a security review actually asks.\n *\n * ## PER-ENDPOINT, if a contract mixes them\n *\n * `request.route` carries `methodName`, `path`, `httpMethod` and `authMeta`, so a subclass can\n * re-point some endpoints of a contract and leave the rest on the configured host, with no API\n * change:\n *\n * ```ts\n * class DeliverOnlyBaseUrlFilter extends ContextBaseUrlFilter {\n *     override async filter(request: ClientRequest, next: Service<ClientRequest, Response>) {\n *         if (request.route.methodName !== 'deliver') return next.invoke(request);\n *         return super.filter(request, next);\n *     }\n * }\n * ```\n *\n * ## Scope, and why it cannot leak\n *\n * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the\n * next call through the same client starts from its configured host again; and the context entry is\n * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets\n * a different URL per partner gets exactly the URL it set, per iteration.\n *\n * ## The SSRF guard is NOT registered here\n *\n * Re-pointing arms it by itself — `ClientRequest.pointAtBaseUrl` flips\n * `destinationCameFromData`, and the framework's own guard sits beneath every app filter and reads\n * that. So this filter cannot forget to bring the guard along, and an app cannot install this one\n * without it. The only thing this class carries is WHICH policy the guard applies, and only\n * because the single legitimate relaxation ({@link SsrfTestingPolicy}) belongs at the same\n * construction site as the decision to be re-pointable at all.\n */\nexport class ContextBaseUrlFilter extends Filter<ClientRequest, Response> {\n    constructor(\n        /**\n         * What the framework's SSRF guard holds this client's re-pointed URLs to.\n         *\n         * Defaulted to {@link SsrfPolicy} (the strict one), and that default is the SAFE branch, so the\n         * omitted argument can never be the permissive one — the widening has to be typed out, with\n         * a reason, as `new ContextBaseUrlFilter(new SsrfTestingPolicy('<why>'))`.\n         */\n        readonly ssrfPolicy: SsrfPolicy = new SsrfPolicy(),\n    ) {\n        super();\n    }\n\n    override async filter(request: ClientRequest, nextFilter: Service<ClientRequest, Response>): Promise<Response> {\n        const override = RequestContext.getUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL);\n        if (override === undefined || override === '') {\n            throw new MissingRuntimeBaseUrlError(\n                `${request.contractName}.${request.route.methodName} runs behind a ContextBaseUrlFilter, so ` +\n                    `its destination must be supplied per call, but no ` +\n                    `WebpiecesCoreHeaders.OVERRIDE_BASE_URL was found in the RequestContext. Set it around ` +\n                    `the call:\\n` +\n                    `    RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\\n` +\n                    `Refusing rather than falling back to this client's configured service URL is ` +\n                    `deliberate: a silent fallback would send a partner's payload to one of our own services.`,\n                `${request.contractName}.${request.route.methodName}`,\n            );\n        }\n        request.pointAtBaseUrl(override);\n        return nextFilter.invoke(request);\n    }\n}\n"]}

package/src/CreateRpcClientCompileAssertions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * COMPILE-TIME assertions pinning `createRpcClient`'s filters argument to ONE spelling per decision.
+ *
+ * A CLASS is one shape and cannot express "absent, or at least one" — so the argument is a NON-EMPTY
+ * tuple, and the empty array that used to mean the same thing as omitting it is a COMPILE error. See
+ * `.claude/review/backwards-compatibility.md` shim shape #1: the fix for two spellings is to make the
+ * type unsatisfiable in the bad case, not to document a preference.
+ *
+ * WHY THIS FILE AND NOT A SPEC. `tsconfig.lib.json` EXCLUDES `*.spec.ts`, and vitest strips types
+ * with esbuild rather than checking them — so a `@ts-expect-error` in a spec is inert and the suite
+ * passes whether or not the bad case still compiles. Here it is compiled by the build: if any line
+ * below ever starts compiling, tsc fails with TS2578 ("Unused '@ts-expect-error' directive"). That
+ * failure IS the test. Mirrors `core-util/src/http/AuthJwtCompileAssertions.ts`.
+ *
+ * Nothing here runs. The class is never constructed and never exported from the barrel.
+ */
+export {};

package/src/CreateRpcClientCompileAssertions.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * COMPILE-TIME assertions pinning `createRpcClient`'s filters argument to ONE spelling per decision.
+ *
+ * A CLASS is one shape and cannot express "absent, or at least one" — so the argument is a NON-EMPTY
+ * tuple, and the empty array that used to mean the same thing as omitting it is a COMPILE error. See
+ * `.claude/review/backwards-compatibility.md` shim shape #1: the fix for two spellings is to make the
+ * type unsatisfiable in the bad case, not to document a preference.
+ *
+ * WHY THIS FILE AND NOT A SPEC. `tsconfig.lib.json` EXCLUDES `*.spec.ts`, and vitest strips types
+ * with esbuild rather than checking them — so a `@ts-expect-error` in a spec is inert and the suite
+ * passes whether or not the bad case still compiles. Here it is compiled by the build: if any line
+ * below ever starts compiling, tsc fails with TS2578 ("Unused '@ts-expect-error' directive"). That
+ * failure IS the test. Mirrors `core-util/src/http/AuthJwtCompileAssertions.ts`.
+ *
+ * Nothing here runs. The class is never constructed and never exported from the barrel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_client_core_1 = require("@webpieces/http-client-core");
+const ClientConfig_1 = require("./ClientConfig");
+const ContextBaseUrlFilter_1 = require("./ContextBaseUrlFilter");
+class CreateRpcClientCompileAssertions {
+    /** ✅ No app filters — the ONE spelling for it is omitting the argument. */
+    noFilters() {
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('server2'));
+    }
+    /** ✅ One app filter. */
+    oneFilter() {
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('partner-webhooks'), [
+            new http_client_core_1.ClientFilterDefinition(1000, new ContextBaseUrlFilter_1.ContextBaseUrlFilter()),
+        ]);
+    }
+    /** ✅ Several app filters. */
+    severalFilters() {
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('partner-webhooks'), [
+            new http_client_core_1.ClientFilterDefinition(1000, new ContextBaseUrlFilter_1.ContextBaseUrlFilter()),
+            new http_client_core_1.ClientFilterDefinition(500, new ContextBaseUrlFilter_1.ContextBaseUrlFilter()),
+        ]);
+    }
+    /**
+     * ❌ `[]` is a SECOND way to say what omitting the argument already says. Deleting it by type is
+     * what keeps "this client has no app filters" to one spelling.
+     */
+    emptyArrayDoesNotCompile() {
+        // @ts-expect-error - pass no third argument instead; [] is a second spelling of that
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('server2'), []);
+    }
+}
+void CreateRpcClientCompileAssertions;
+//# sourceMappingURL=CreateRpcClientCompileAssertions.js.map

package/src/CreateRpcClientCompileAssertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateRpcClientCompileAssertions.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/CreateRpcClientCompileAssertions.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAEH,kEAAqE;AACrE,iDAA8C;AAE9C,iEAA8D;AAM9D,MAAM,gCAAgC;IAClC,2EAA2E;IAC3E,SAAS;QACL,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,wBAAwB;IACxB,SAAS;QACL,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,kBAAkB,CAAC,EAAE;YACnE,IAAI,yCAAsB,CAAC,IAAI,EAAE,IAAI,2CAAoB,EAAE,CAAC;SAC/D,CAAC,CAAC;IACP,CAAC;IAED,6BAA6B;IAC7B,cAAc;QACV,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,kBAAkB,CAAC,EAAE;YACnE,IAAI,yCAAsB,CAAC,IAAI,EAAE,IAAI,2CAAoB,EAAE,CAAC;YAC5D,IAAI,yCAAsB,CAAC,GAAG,EAAE,IAAI,2CAAoB,EAAE,CAAC;SAC9D,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,wBAAwB;QACpB,qFAAqF;QACrF,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;CACJ;AAED,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * COMPILE-TIME assertions pinning `createRpcClient`'s filters argument to ONE spelling per decision.\n *\n * A CLASS is one shape and cannot express \"absent, or at least one\" — so the argument is a NON-EMPTY\n * tuple, and the empty array that used to mean the same thing as omitting it is a COMPILE error. See\n * `.claude/review/backwards-compatibility.md` shim shape #1: the fix for two spellings is to make the\n * type unsatisfiable in the bad case, not to document a preference.\n *\n * WHY THIS FILE AND NOT A SPEC. `tsconfig.lib.json` EXCLUDES `*.spec.ts`, and vitest strips types\n * with esbuild rather than checking them — so a `@ts-expect-error` in a spec is inert and the suite\n * passes whether or not the bad case still compiles. Here it is compiled by the build: if any line\n * below ever starts compiling, tsc fails with TS2578 (\"Unused '@ts-expect-error' directive\"). That\n * failure IS the test. Mirrors `core-util/src/http/AuthJwtCompileAssertions.ts`.\n *\n * Nothing here runs. The class is never constructed and never exported from the barrel.\n */\n\nimport { ClientFilterDefinition } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { ClientHttpFactory } from './ClientHttpFactory';\nimport { ContextBaseUrlFilter } from './ContextBaseUrlFilter';\n\n/** Stand-in for a real contract; only its TYPE is used, and only by tsc. */\ndeclare const someApi: Parameters<ClientHttpFactory['createRpcClient']>[0];\ndeclare const factory: ClientHttpFactory;\n\nclass CreateRpcClientCompileAssertions {\n    /** ✅ No app filters — the ONE spelling for it is omitting the argument. */\n    noFilters(): void {\n        factory.createRpcClient(someApi, new ClientConfig('server2'));\n    }\n\n    /** ✅ One app filter. */\n    oneFilter(): void {\n        factory.createRpcClient(someApi, new ClientConfig('partner-webhooks'), [\n            new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n        ]);\n    }\n\n    /** ✅ Several app filters. */\n    severalFilters(): void {\n        factory.createRpcClient(someApi, new ClientConfig('partner-webhooks'), [\n            new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n            new ClientFilterDefinition(500, new ContextBaseUrlFilter()),\n        ]);\n    }\n\n    /**\n     * ❌ `[]` is a SECOND way to say what omitting the argument already says. Deleting it by type is\n     * what keeps \"this client has no app filters\" to one spelling.\n     */\n    emptyArrayDoesNotCompile(): void {\n        // @ts-expect-error - pass no third argument instead; [] is a second spelling of that\n        factory.createRpcClient(someApi, new ClientConfig('server2'), []);\n    }\n}\n\nvoid CreateRpcClientCompileAssertions;\n"]}

package/src/InternalAddressRules.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Which IP addresses count as INTERNAL — i.e. reachable only because of where our process happens
+ * to sit, and therefore never a legitimate destination for a URL a partner supplied.
+ *
+ * Pure and dependency-free (it judges an address string, it does not resolve one), so it is unit
+ * testable without DNS and is shared by the URL check and the redirect check.
+ *
+ * The list is deliberately WIDER than "RFC1918". A consumer running on a VPC connector can reach a
+ * great deal more than 10/8, and the address that actually gets stolen in practice is
+ * `169.254.169.254` — the cloud metadata service, which hands out the runtime service account's
+ * tokens to anything that asks.
+ */
+export declare class InternalAddressRules {
+    /** IPv4 CIDRs that are internal, as [network, prefix length]. */
+    private static readonly V4_BLOCKS;
+    /**
+     * Hostnames that are internal by NAME, independent of what they resolve to. Checked before DNS
+     * because the metadata service answers to its name inside every GCP VM and the name is what
+     * appears in a copy-pasted URL.
+     */
+    private static readonly INTERNAL_HOSTNAMES;
+    /** True when `hostname` is internal by name alone (no DNS needed). */
+    isInternalHostname(hostname: string): boolean;
+    /**
+     * True when `address` is an internal IP. Accepts IPv4 dotted-quad and IPv6 (including the
+     * IPv4-mapped `::ffff:a.b.c.d` form, which is how a dual-stack resolver reports an IPv4 answer
+     * and therefore the obvious way to smuggle 127.0.0.1 past an IPv4-only check).
+     *
+     * An address it cannot parse is treated as INTERNAL. Unparseable means "we do not know what this
+     * is", and the safe answer to that on the SSRF path is refusal, not delivery.
+     */
+    isInternalAddress(address: string): boolean;
+    private isInternalV4;
+    private isInternalV6;
+    /** The dotted quad as a 32-bit number, or undefined when it is not a dotted quad at all. */
+    private toV4Number;
+}

package/src/InternalAddressRules.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalAddressRules = void 0;
+/**
+ * Which IP addresses count as INTERNAL — i.e. reachable only because of where our process happens
+ * to sit, and therefore never a legitimate destination for a URL a partner supplied.
+ *
+ * Pure and dependency-free (it judges an address string, it does not resolve one), so it is unit
+ * testable without DNS and is shared by the URL check and the redirect check.
+ *
+ * The list is deliberately WIDER than "RFC1918". A consumer running on a VPC connector can reach a
+ * great deal more than 10/8, and the address that actually gets stolen in practice is
+ * `169.254.169.254` — the cloud metadata service, which hands out the runtime service account's
+ * tokens to anything that asks.
+ */
+class InternalAddressRules {
+    /** IPv4 CIDRs that are internal, as [network, prefix length]. */
+    static V4_BLOCKS = [
+        ['0.0.0.0', 8], //        "this network" — 0.x is routed to localhost by some stacks
+        ['10.0.0.0', 8], //       RFC1918 private
+        ['100.64.0.0', 10], //    RFC6598 carrier-grade NAT — a shared-tenant range, never ours to trust
+        ['127.0.0.0', 8], //      loopback
+        ['169.254.0.0', 16], //   link-local, and with it 169.254.169.254 CLOUD METADATA
+        ['172.16.0.0', 12], //    RFC1918 private
+        ['192.0.0.0', 24], //     IETF protocol assignments
+        ['192.0.2.0', 24], //     TEST-NET-1
+        ['192.168.0.0', 16], //   RFC1918 private
+        ['198.18.0.0', 15], //    benchmarking
+        ['198.51.100.0', 24], //  TEST-NET-2
+        ['203.0.113.0', 24], //   TEST-NET-3
+        ['224.0.0.0', 4], //      multicast
+        ['240.0.0.0', 4], //      reserved, incl. 255.255.255.255 broadcast
+    ];
+    /**
+     * Hostnames that are internal by NAME, independent of what they resolve to. Checked before DNS
+     * because the metadata service answers to its name inside every GCP VM and the name is what
+     * appears in a copy-pasted URL.
+     */
+    static INTERNAL_HOSTNAMES = new Set([
+        'localhost',
+        'metadata',
+        'metadata.google.internal',
+        'metadata.goog',
+        'instance-data',
+    ]);
+    /** True when `hostname` is internal by name alone (no DNS needed). */
+    isInternalHostname(hostname) {
+        const lower = hostname.toLowerCase().replace(/\.$/, '');
+        if (InternalAddressRules.INTERNAL_HOSTNAMES.has(lower)) {
+            return true;
+        }
+        // Any *.internal / *.localhost name is infrastructure-local by convention.
+        return lower.endsWith('.internal') || lower.endsWith('.localhost');
+    }
+    /**
+     * True when `address` is an internal IP. Accepts IPv4 dotted-quad and IPv6 (including the
+     * IPv4-mapped `::ffff:a.b.c.d` form, which is how a dual-stack resolver reports an IPv4 answer
+     * and therefore the obvious way to smuggle 127.0.0.1 past an IPv4-only check).
+     *
+     * An address it cannot parse is treated as INTERNAL. Unparseable means "we do not know what this
+     * is", and the safe answer to that on the SSRF path is refusal, not delivery.
+     */
+    isInternalAddress(address) {
+        const bare = address.replace(/^\[|\]$/g, '').split('%')[0];
+        if (bare.includes(':')) {
+            return this.isInternalV6(bare);
+        }
+        return this.isInternalV4(bare);
+    }
+    isInternalV4(address) {
+        const value = this.toV4Number(address);
+        if (value === undefined) {
+            return true;
+        }
+        for (const block of InternalAddressRules.V4_BLOCKS) {
+            const network = this.toV4Number(block[0]);
+            if (network === undefined) {
+                continue;
+            }
+            // A /0 mask would shift by 32, which is a no-op in JS — no block here uses one.
+            const mask = (0xffffffff << (32 - block[1])) >>> 0;
+            if ((value & mask) >>> 0 === (network & mask) >>> 0) {
+                return true;
+            }
+        }
+        return false;
+    }
+    isInternalV6(address) {
+        const lower = address.toLowerCase();
+        // A dual-stack resolver reports IPv4 as ::ffff:a.b.c.d — judge it as the IPv4 it is.
+        const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+        if (mapped) {
+            return this.isInternalV4(mapped[1]);
+        }
+        // …and the URL parser NORMALIZES that same address to its hex form, `::ffff:7f00:1`. Both
+        // spellings name 127.0.0.1, so both have to be judged as it — checking only the dotted form
+        // would let `https://[::ffff:127.0.0.1]` through the moment it went through `new URL()`.
+        const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower);
+        if (mappedHex) {
+            const high = parseInt(mappedHex[1], 16);
+            const low = parseInt(mappedHex[2], 16);
+            const dotted = `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+            return this.isInternalV4(dotted);
+        }
+        if (lower === '::1' || lower === '::') {
+            return true;
+        }
+        // fc00::/7 unique-local, fe80::/10 link-local, ff00::/8 multicast.
+        return /^f[cd]/.test(lower) || /^fe[89ab]/.test(lower) || lower.startsWith('ff');
+    }
+    /** The dotted quad as a 32-bit number, or undefined when it is not a dotted quad at all. */
+    toV4Number(address) {
+        const parts = address.split('.');
+        if (parts.length !== 4) {
+            return undefined;
+        }
+        let value = 0;
+        for (const part of parts) {
+            if (!/^\d{1,3}$/.test(part)) {
+                return undefined;
+            }
+            const octet = Number(part);
+            if (octet > 255) {
+                return undefined;
+            }
+            value = (value * 256 + octet) >>> 0;
+        }
+        return value;
+    }
+}
+exports.InternalAddressRules = InternalAddressRules;
+//# sourceMappingURL=InternalAddressRules.js.map

package/src/InternalAddressRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InternalAddressRules.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/InternalAddressRules.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;GAWG;AACH,MAAa,oBAAoB;IAC7B,iEAAiE;IACzD,MAAM,CAAU,SAAS,GAA6C;QAC1E,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,oEAAoE;QACpF,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,wBAAwB;QACzC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,4EAA4E;QAChG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,gBAAgB;QAClC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,2DAA2D;QAChF,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,qBAAqB;QACzC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,gCAAgC;QACnD,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,iBAAiB;QACpC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,oBAAoB;QACzC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB;QACtC,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,cAAc;QACpC,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,eAAe;QACpC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,iBAAiB;QACnC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,iDAAiD;KACtE,CAAC;IAEF;;;;OAIG;IACK,MAAM,CAAU,kBAAkB,GAAwB,IAAI,GAAG,CAAC;QACtE,WAAW;QACX,UAAU;QACV,0BAA0B;QAC1B,eAAe;QACf,eAAe;KAClB,CAAC,CAAC;IAEH,sEAAsE;IACtE,kBAAkB,CAAC,QAAgB;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,oBAAoB,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,2EAA2E;QAC3E,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB,CAAC,OAAe;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,OAAe;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,oBAAoB,CAAC,SAAS,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAS;YACb,CAAC;YACD,gFAAgF;YAChF,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,YAAY,CAAC,OAAe;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,qFAAqF;QACrF,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,SAAS,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,mEAAmE;QACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC;IAED,4FAA4F;IACpF,UAAU,CAAC,OAAe;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,KAAK,GAAG,CAAC,KAAK,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;;AAvHL,oDAwHC","sourcesContent":["/**\n * Which IP addresses count as INTERNAL — i.e. reachable only because of where our process happens\n * to sit, and therefore never a legitimate destination for a URL a partner supplied.\n *\n * Pure and dependency-free (it judges an address string, it does not resolve one), so it is unit\n * testable without DNS and is shared by the URL check and the redirect check.\n *\n * The list is deliberately WIDER than \"RFC1918\". A consumer running on a VPC connector can reach a\n * great deal more than 10/8, and the address that actually gets stolen in practice is\n * `169.254.169.254` — the cloud metadata service, which hands out the runtime service account's\n * tokens to anything that asks.\n */\nexport class InternalAddressRules {\n    /** IPv4 CIDRs that are internal, as [network, prefix length]. */\n    private static readonly V4_BLOCKS: ReadonlyArray<readonly [string, number]> = [\n        ['0.0.0.0', 8], //        \"this network\" — 0.x is routed to localhost by some stacks\n        ['10.0.0.0', 8], //       RFC1918 private\n        ['100.64.0.0', 10], //    RFC6598 carrier-grade NAT — a shared-tenant range, never ours to trust\n        ['127.0.0.0', 8], //      loopback\n        ['169.254.0.0', 16], //   link-local, and with it 169.254.169.254 CLOUD METADATA\n        ['172.16.0.0', 12], //    RFC1918 private\n        ['192.0.0.0', 24], //     IETF protocol assignments\n        ['192.0.2.0', 24], //     TEST-NET-1\n        ['192.168.0.0', 16], //   RFC1918 private\n        ['198.18.0.0', 15], //    benchmarking\n        ['198.51.100.0', 24], //  TEST-NET-2\n        ['203.0.113.0', 24], //   TEST-NET-3\n        ['224.0.0.0', 4], //      multicast\n        ['240.0.0.0', 4], //      reserved, incl. 255.255.255.255 broadcast\n    ];\n\n    /**\n     * Hostnames that are internal by NAME, independent of what they resolve to. Checked before DNS\n     * because the metadata service answers to its name inside every GCP VM and the name is what\n     * appears in a copy-pasted URL.\n     */\n    private static readonly INTERNAL_HOSTNAMES: ReadonlySet<string> = new Set([\n        'localhost',\n        'metadata',\n        'metadata.google.internal',\n        'metadata.goog',\n        'instance-data',\n    ]);\n\n    /** True when `hostname` is internal by name alone (no DNS needed). */\n    isInternalHostname(hostname: string): boolean {\n        const lower = hostname.toLowerCase().replace(/\\.$/, '');\n        if (InternalAddressRules.INTERNAL_HOSTNAMES.has(lower)) {\n            return true;\n        }\n        // Any *.internal / *.localhost name is infrastructure-local by convention.\n        return lower.endsWith('.internal') || lower.endsWith('.localhost');\n    }\n\n    /**\n     * True when `address` is an internal IP. Accepts IPv4 dotted-quad and IPv6 (including the\n     * IPv4-mapped `::ffff:a.b.c.d` form, which is how a dual-stack resolver reports an IPv4 answer\n     * and therefore the obvious way to smuggle 127.0.0.1 past an IPv4-only check).\n     *\n     * An address it cannot parse is treated as INTERNAL. Unparseable means \"we do not know what this\n     * is\", and the safe answer to that on the SSRF path is refusal, not delivery.\n     */\n    isInternalAddress(address: string): boolean {\n        const bare = address.replace(/^\\[|\\]$/g, '').split('%')[0];\n        if (bare.includes(':')) {\n            return this.isInternalV6(bare);\n        }\n        return this.isInternalV4(bare);\n    }\n\n    private isInternalV4(address: string): boolean {\n        const value = this.toV4Number(address);\n        if (value === undefined) {\n            return true;\n        }\n        for (const block of InternalAddressRules.V4_BLOCKS) {\n            const network = this.toV4Number(block[0]);\n            if (network === undefined) {\n                continue;\n            }\n            // A /0 mask would shift by 32, which is a no-op in JS — no block here uses one.\n            const mask = (0xffffffff << (32 - block[1])) >>> 0;\n            if ((value & mask) >>> 0 === (network & mask) >>> 0) {\n                return true;\n            }\n        }\n        return false;\n    }\n\n    private isInternalV6(address: string): boolean {\n        const lower = address.toLowerCase();\n        // A dual-stack resolver reports IPv4 as ::ffff:a.b.c.d — judge it as the IPv4 it is.\n        const mapped = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(lower);\n        if (mapped) {\n            return this.isInternalV4(mapped[1]);\n        }\n        // …and the URL parser NORMALIZES that same address to its hex form, `::ffff:7f00:1`. Both\n        // spellings name 127.0.0.1, so both have to be judged as it — checking only the dotted form\n        // would let `https://[::ffff:127.0.0.1]` through the moment it went through `new URL()`.\n        const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower);\n        if (mappedHex) {\n            const high = parseInt(mappedHex[1], 16);\n            const low = parseInt(mappedHex[2], 16);\n            const dotted = `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;\n            return this.isInternalV4(dotted);\n        }\n        if (lower === '::1' || lower === '::') {\n            return true;\n        }\n        // fc00::/7 unique-local, fe80::/10 link-local, ff00::/8 multicast.\n        return /^f[cd]/.test(lower) || /^fe[89ab]/.test(lower) || lower.startsWith('ff');\n    }\n\n    /** The dotted quad as a 32-bit number, or undefined when it is not a dotted quad at all. */\n    private toV4Number(address: string): number | undefined {\n        const parts = address.split('.');\n        if (parts.length !== 4) {\n            return undefined;\n        }\n        let value = 0;\n        for (const part of parts) {\n            if (!/^\\d{1,3}$/.test(part)) {\n                return undefined;\n            }\n            const octet = Number(part);\n            if (octet > 255) {\n                return undefined;\n            }\n            value = (value * 256 + octet) >>> 0;\n        }\n        return value;\n    }\n}\n"]}

package/src/MissingRuntimeBaseUrlError.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A client carrying a {@link ContextBaseUrlFilter} was called with no
+ * `WebpiecesCoreHeaders.OVERRIDE_BASE_URL` in the ambient RequestContext, so this call has nowhere
+ * to go.
+ *
+ * It is a THROW rather than a fallback to the client's configured service URL, deliberately: a
+ * silent fallback would send a partner's payload to one of our own services, which is a worse
+ * outcome than a loud failure by every measure.
+ *
+ * Its OWN type, not a bare Error and NOT an {@link SsrfRefusedError}: a delivery worker has to tell
+ * "we were misconfigured" (page somebody; retrying is pointless) from "the partner registered
+ * something hostile" (dead-letter it). Different owners, different cures.
+ */
+export declare class MissingRuntimeBaseUrlError extends Error {
+    /** `Contract.method`, so the log line names the call that had nowhere to go. */
+    readonly endpoint: string;
+    constructor(message: string, 
+    /** `Contract.method`, so the log line names the call that had nowhere to go. */
+    endpoint: string);
+}

package/src/MissingRuntimeBaseUrlError.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingRuntimeBaseUrlError = void 0;
+/**
+ * A client carrying a {@link ContextBaseUrlFilter} was called with no
+ * `WebpiecesCoreHeaders.OVERRIDE_BASE_URL` in the ambient RequestContext, so this call has nowhere
+ * to go.
+ *
+ * It is a THROW rather than a fallback to the client's configured service URL, deliberately: a
+ * silent fallback would send a partner's payload to one of our own services, which is a worse
+ * outcome than a loud failure by every measure.
+ *
+ * Its OWN type, not a bare Error and NOT an {@link SsrfRefusedError}: a delivery worker has to tell
+ * "we were misconfigured" (page somebody; retrying is pointless) from "the partner registered
+ * something hostile" (dead-letter it). Different owners, different cures.
+ */
+class MissingRuntimeBaseUrlError extends Error {
+    endpoint;
+    constructor(message, 
+    /** `Contract.method`, so the log line names the call that had nowhere to go. */
+    endpoint) {
+        super(message);
+        this.endpoint = endpoint;
+        this.name = 'MissingRuntimeBaseUrlError';
+    }
+}
+exports.MissingRuntimeBaseUrlError = MissingRuntimeBaseUrlError;
+//# sourceMappingURL=MissingRuntimeBaseUrlError.js.map

package/src/MissingRuntimeBaseUrlError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MissingRuntimeBaseUrlError.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/MissingRuntimeBaseUrlError.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,MAAa,0BAA2B,SAAQ,KAAK;IAI7B;IAHpB,YACI,OAAe;IACf,gFAAgF;IAChE,QAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC7C,CAAC;CACJ;AATD,gEASC","sourcesContent":["/**\n * A client carrying a {@link ContextBaseUrlFilter} was called with no\n * `WebpiecesCoreHeaders.OVERRIDE_BASE_URL` in the ambient RequestContext, so this call has nowhere\n * to go.\n *\n * It is a THROW rather than a fallback to the client's configured service URL, deliberately: a\n * silent fallback would send a partner's payload to one of our own services, which is a worse\n * outcome than a loud failure by every measure.\n *\n * Its OWN type, not a bare Error and NOT an {@link SsrfRefusedError}: a delivery worker has to tell\n * \"we were misconfigured\" (page somebody; retrying is pointless) from \"the partner registered\n * something hostile\" (dead-letter it). Different owners, different cures.\n */\nexport class MissingRuntimeBaseUrlError extends Error {\n    constructor(\n        message: string,\n        /** `Contract.method`, so the log line names the call that had nowhere to go. */\n        public readonly endpoint: string,\n    ) {\n        super(message);\n        this.name = 'MissingRuntimeBaseUrlError';\n    }\n}\n"]}

package/src/NodeProxyClient.d.ts

@@ -1,8 +1,10 @@
-import { AuthMeta, DestinationTrust, RouteMetadata, Secrets } from '@webpieces/core-util';
+import { DestinationTrust, RouteMetadata, Secrets } from '@webpieces/core-util';
 import { RequestContextHeaders } from '@webpieces/core-context';
 import { GcpOidc } from '@webpieces/gcp-identity';
-import { ApiPrototype, ProxyClient, TranslatedFailure } from '@webpieces/http-client-core';
+import { ApiPrototype, ClientFilterDefinition, ProxyClient, TranslatedFailure } from '@webpieces/http-client-core';
+import { AddressResolver } from './AddressResolver';
 import { ClientConfig } from './ClientConfig';
+import { WebhookSignerCallback } from './WebhookSignerCallback';
 /**
  * The server-side {@link ProxyClient}. Everything a browser cannot do lives here: reading the
  * ambient RequestContext, minting OIDC tokens, holding shared secrets, and recording test cases.
@@ -14,11 +16,16 @@ import { ClientConfig } from './ClientConfig';
 export declare class NodeProxyClient extends ProxyClient {
     private readonly headers;
     private readonly gcpOidc;
+    private readonly addressResolver;
     private readonly secrets?;
+    private readonly webhookSigner?;
     private config;
-    constructor(headers: RequestContextHeaders, gcpOidc: GcpOidc, secrets?: Secrets | undefined);
-    /** Bind this client to one API contract + target. */
-    init(apiPrototype: ApiPrototype<object>, config: ClientConfig): void;
+    constructor(headers: RequestContextHeaders, gcpOidc: GcpOidc, addressResolver: AddressResolver, secrets?: Secrets | undefined, webhookSigner?: WebhookSignerCallback | undefined);
+    /**
+     * Bind this client to one API contract + target, with the app's outbound filters (url
+     * rewriting, header editing, logging, per-call re-pointing).
+     */
+    init(apiPrototype: ApiPrototype<object>, config: ClientConfig, appFilters: ClientFilterDefinition[]): void;
     /**
      * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but
      * with NODE's fallback: THROW. A server has no "own origin" to fall back to the way a browser
@@ -28,6 +35,27 @@ export declare class NodeProxyClient extends ProxyClient {
      * read beneath a deriver is memoized process-wide, so only the first call pays.
      */
     protected resolveBaseUrl(): Promise<string>;
+    /**
+     * The two framework built-ins, installed on EVERY client this package builds and ordered
+     * beneath every app filter by {@link ProxyClient.initRoutes}.
+     *
+     * They are unconditional rather than opt-in because neither costs anything on the path that
+     * does not need it: the SSRF guard steps aside when nothing re-pointed the request, and the
+     * auth filter does nothing for a `@Public` endpoint. An app therefore cannot forget to install
+     * the guard on the one client that takes runtime URLs — the ACT of re-pointing is what arms it.
+     */
+    protected clientFilters(): ClientFilterDefinition[];
+    /**
+     * WHICH policy the guard applies when something does re-point this client.
+     *
+     * Read off an installed {@link ContextBaseUrlFilter}, because that filter is where an app says
+     * "this client may be re-pointed", and the single legitimate relaxation
+     * ({@link SsrfTestingPolicy}) belongs at the same construction site as that decision rather
+     * than in a second place a reader has to correlate. No such filter — or one built with the
+     * default — means {@link SsrfPolicy} (the strict one), so the safe answer is what an app gets by saying
+     * nothing.
+     */
+    private ssrfPolicy;
     /**
      * Straight from the RequestContext. Throws when there is no active request scope.
      *
@@ -37,15 +65,6 @@ export declare class NodeProxyClient extends ProxyClient {
      * friends instead of shipping headers that endpoint's AuthFilter is obliged to reject.
      */
     protected outboundContextHeaders(destination: DestinationTrust): Map<string, string>;
-    /**
-     * Attach the outbound credential for the endpoint's AuthMode: an @AuthOidc bearer minted as
-     * this caller's runtime SA (audience = the callee base URL — the server verifies the signature
-     * + caller allow-list), or the @AuthSharedSecret(key) value THIS client sends from its bound
-     * {@link Secrets}. Both ride in the ONE `Authorization` header under their own scheme —
-     * `Bearer <oidc>` / `Webpieces <secret>` — which is never a context key, so it cannot leak onto
-     * the next hop. Never reads process.env.
-     */
-    protected attachOutboundAuth(route: RouteMetadata, baseUrl: string, httpHeaders: Record<string, string>): Promise<void>;
     /**
      * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is
      * travelling in the magic context, capture this outbound call + its result so it becomes a mock
@@ -59,8 +78,6 @@ export declare class NodeProxyClient extends ProxyClient {
      * from the call path — a logging backend stamps its own fields and never sees this.
      */
     private recordCall;
-    /** A server can satisfy every auth mode, so nothing is rejected at bind time. */
-    protected assertEndpointSupported(_authMeta: AuthMeta | undefined, _methodName: string): void;
     /**
      * SERVER-TO-SERVER: a 4xx received from a dependency becomes THIS server's own 500.
      *

package/src/NodeProxyClient.js

@@ -7,6 +7,21 @@ const core_util_1 = require("@webpieces/core-util");
 const core_context_1 = require("@webpieces/core-context");
 const gcp_identity_1 = require("@webpieces/gcp-identity");
 const http_client_core_1 = require("@webpieces/http-client-core");
+const AddressResolver_1 = require("./AddressResolver");
+const ContextBaseUrlFilter_1 = require("./ContextBaseUrlFilter");
+const OutboundAuthFilter_1 = require("./OutboundAuthFilter");
+const SsrfGuardFilter_1 = require("./SsrfGuardFilter");
+const SsrfPolicy_1 = require("./SsrfPolicy");
+const WebhookSignerCallback_1 = require("./WebhookSignerCallback");
+/**
+ * The two framework built-ins' priorities, RELATIVE TO EACH OTHER and to nothing else — they are
+ * ordered beneath every app filter structurally, not by number (see `ProxyClient.initRoutes`).
+ *
+ * The guard is OUTSIDE the minter deliberately: a destination that is going to be refused must be
+ * refused BEFORE a credential is minted for it, so a hostile URL never causes a token to exist.
+ */
+const SSRF_GUARD_PRIORITY = 900;
+const OUTBOUND_AUTH_PRIORITY = 800;
 /**
  * The server-side {@link ProxyClient}. Everything a browser cannot do lives here: reading the
  * ambient RequestContext, minting OIDC tokens, holding shared secrets, and recording test cases.
@@ -18,18 +33,25 @@ const http_client_core_1 = require("@webpieces/http-client-core");
 let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClient {
     headers;
     gcpOidc;
+    addressResolver;
     secrets;
+    webhookSigner;
     config;
-    constructor(headers, gcpOidc, secrets) {
+    constructor(headers, gcpOidc, addressResolver, secrets, webhookSigner) {
         super();
         this.headers = headers;
         this.gcpOidc = gcpOidc;
+        this.addressResolver = addressResolver;
         this.secrets = secrets;
+        this.webhookSigner = webhookSigner;
     }
-    /** Bind this client to one API contract + target. */
-    init(apiPrototype, config) {
+    /**
+     * Bind this client to one API contract + target, with the app's outbound filters (url
+     * rewriting, header editing, logging, per-call re-pointing).
+     */
+    init(apiPrototype, config, appFilters) {
         this.config = config;
-        this.initRoutes(apiPrototype);
+        this.initRoutes(apiPrototype, appFilters);
     }
     /**
      * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but
@@ -42,6 +64,39 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
     resolveBaseUrl() {
         return core_util_1.ClientRegistry.resolve(this.config.svcName);
     }
+    /**
+     * The two framework built-ins, installed on EVERY client this package builds and ordered
+     * beneath every app filter by {@link ProxyClient.initRoutes}.
+     *
+     * They are unconditional rather than opt-in because neither costs anything on the path that
+     * does not need it: the SSRF guard steps aside when nothing re-pointed the request, and the
+     * auth filter does nothing for a `@Public` endpoint. An app therefore cannot forget to install
+     * the guard on the one client that takes runtime URLs — the ACT of re-pointing is what arms it.
+     */
+    clientFilters() {
+        return [
+            new http_client_core_1.ClientFilterDefinition(SSRF_GUARD_PRIORITY, new SsrfGuardFilter_1.SsrfGuardFilter(this.ssrfPolicy(), this.addressResolver)),
+            new http_client_core_1.ClientFilterDefinition(OUTBOUND_AUTH_PRIORITY, new OutboundAuthFilter_1.OutboundAuthFilter(this.gcpOidc, this.secrets, this.webhookSigner)),
+        ];
+    }
+    /**
+     * WHICH policy the guard applies when something does re-point this client.
+     *
+     * Read off an installed {@link ContextBaseUrlFilter}, because that filter is where an app says
+     * "this client may be re-pointed", and the single legitimate relaxation
+     * ({@link SsrfTestingPolicy}) belongs at the same construction site as that decision rather
+     * than in a second place a reader has to correlate. No such filter — or one built with the
+     * default — means {@link SsrfPolicy} (the strict one), so the safe answer is what an app gets by saying
+     * nothing.
+     */
+    ssrfPolicy() {
+        for (const definition of this.appFilters) {
+            const filter = definition.filter;
+            if (filter instanceof ContextBaseUrlFilter_1.ContextBaseUrlFilter)
+                return filter.ssrfPolicy;
+        }
+        return new SsrfPolicy_1.SsrfPolicy();
+    }
     /**
      * Straight from the RequestContext. Throws when there is no active request scope.
      *
@@ -53,29 +108,6 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
     outboundContextHeaders(destination) {
         return this.headers.buildOutboundHeaders(destination);
     }
-    /**
-     * Attach the outbound credential for the endpoint's AuthMode: an @AuthOidc bearer minted as
-     * this caller's runtime SA (audience = the callee base URL — the server verifies the signature
-     * + caller allow-list), or the @AuthSharedSecret(key) value THIS client sends from its bound
-     * {@link Secrets}. Both ride in the ONE `Authorization` header under their own scheme —
-     * `Bearer <oidc>` / `Webpieces <secret>` — which is never a context key, so it cannot leak onto
-     * the next hop. Never reads process.env.
-     */
-    async attachOutboundAuth(route, baseUrl, httpHeaders) {
-        const mode = route.authMeta?.mode;
-        if (mode?.kind === 'oidc') {
-            httpHeaders['Authorization'] = `Bearer ${await this.gcpOidc.mintIdToken(baseUrl)}`;
-        }
-        else if (mode?.kind === 'shared-secret') {
-            const secret = this.secrets?.get(mode.secretKey);
-            if (!secret) {
-                throw new Error(`No shared secret configured for @AuthSharedSecret('${mode.secretKey}') endpoint ${route.methodName}`);
-            }
-            // Same header as a JWT/OIDC token, but its OWN scheme, so a secret can never be
-            // mistaken for a token nor accepted where one was expected.
-            httpHeaders['Authorization'] = `Webpieces ${secret}`;
-        }
-    }
     /**
      * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is
      * travelling in the magic context, capture this outbound call + its result so it becomes a mock
@@ -119,8 +151,6 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
             throw err;
         }
     }
-    /** A server can satisfy every auth mode, so nothing is rejected at bind time. */
-    assertEndpointSupported(_authMeta, _methodName) { }
     /**
      * SERVER-TO-SERVER: a 4xx received from a dependency becomes THIS server's own 500.
      *
@@ -186,11 +216,16 @@ exports.NodeProxyClient = NodeProxyClient = tslib_1.__decorate([
     (0, core_context_1.provideFrameworkTransient)(),
     tslib_1.__param(0, (0, inversify_1.inject)(core_context_1.RequestContextHeaders)),
     tslib_1.__param(1, (0, inversify_1.inject)(gcp_identity_1.GcpOidc)),
-    tslib_1.__param(2, (0, inversify_1.optional)()),
-    tslib_1.__param(2, (0, inversify_1.inject)(core_util_1.SECRETS)),
+    tslib_1.__param(2, (0, inversify_1.inject)(AddressResolver_1.AddressResolver)),
+    tslib_1.__param(3, (0, inversify_1.optional)()),
+    tslib_1.__param(3, (0, inversify_1.inject)(core_util_1.SECRETS)),
+    tslib_1.__param(4, (0, inversify_1.optional)()),
+    tslib_1.__param(4, (0, inversify_1.inject)(WebhookSignerCallback_1.WEBHOOK_SIGNER_CALLBACK)),
     tslib_1.__metadata("design:paramtypes", [core_context_1.RequestContextHeaders,
         gcp_identity_1.GcpOidc,
-        core_util_1.Secrets])
+        AddressResolver_1.AddressResolver,
+        core_util_1.Secrets,
+        WebhookSignerCallback_1.WebhookSignerCallback])
 ], NodeProxyClient);
 /**
  * DI token for the `Provider<NodeProxyClient>` that hands out RPC clients — one per API contract.